Security update for git SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1484-1 Final 1 1 2022-05-02T14:47:40Z current 2022-05-02T14:47:40Z 2022-05-02T14:47:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for git This update for git fixes the following issues: - Updated to version 2.35.3: - CVE-2022-24765: Fixed a potential command injection via git worktree (bsc#1198234). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container bci/golang:1.16-2022-1484,Container bci/golang:1.17-2022-1484,Container bci/golang:1.18-2022-1484,Container bci/golang:1.19-2022-1484,Container bci/golang:1.20-openssl-2022-1484,Container bci/golang:1.21-2022-1484,Container bci/golang:latest-2022-1484,Container bci/node:12-2022-1484,Container bci/node:14-2022-1484,Container bci/node:16-2022-1484,Container bci/node:18-2022-1484,Container bci/nodejs:latest-2022-1484,Container bci/openjdk-devel:11-2022-1484,Container bci/openjdk-devel:latest-2022-1484,Container bci/openjdk:11-2022-1484,Container bci/openjdk:17-2022-1484,Container bci/python:3-2022-1484,Container bci/python:latest-2022-1484,Container bci/ruby:latest-2022-1484,Container suse/git:latest-2022-1484,SUSE-2022-1484,SUSE-SLE-Module-Basesystem-15-SP3-2022-1484,SUSE-SLE-Module-Basesystem-15-SP4-2022-1484,SUSE-SLE-Module-Development-Tools-15-SP3-2022-1484,SUSE-SLE-Module-Development-Tools-15-SP4-2022-1484,openSUSE-SLE-15.3-2022-1484,openSUSE-SLE-15.4-2022-1484 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221484-1/ Link for SUSE-SU-2022:1484-1 https://lists.suse.com/pipermail/sle-security-updates/2022-May/010904.html E-Mail link for SUSE-SU-2022:1484-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181400 SUSE Bug 1181400 https://bugzilla.suse.com/1198234 SUSE Bug 1198234 https://www.suse.com/security/cve/CVE-2022-24765/ SUSE CVE CVE-2022-24765 page Container bci/golang:1.16 Container bci/golang:1.17 Container bci/golang:1.18 Container bci/golang:1.19 Container bci/golang:1.20-openssl Container bci/golang:1.21 Container bci/golang:latest Container bci/node:12 Container bci/node:14 Container bci/node:16 Container bci/node:18 Container bci/nodejs:latest Container bci/openjdk-devel:11 Container bci/openjdk-devel:latest Container bci/openjdk:11 Container bci/openjdk:17 Container bci/python:3 Container bci/python:latest Container bci/ruby:latest Container suse/git:latest SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Development Tools 15 SP3 openSUSE Leap 15.3 openSUSE Leap 15.4 git-core-2.35.3-150300.10.12.1 git-2.35.3-150300.10.12.1 git-arch-2.35.3-150300.10.12.1 git-credential-gnome-keyring-2.35.3-150300.10.12.1 git-credential-libsecret-2.35.3-150300.10.12.1 git-cvs-2.35.3-150300.10.12.1 git-daemon-2.35.3-150300.10.12.1 git-doc-2.35.3-150300.10.12.1 git-email-2.35.3-150300.10.12.1 git-gui-2.35.3-150300.10.12.1 git-p4-2.35.3-150300.10.12.1 git-svn-2.35.3-150300.10.12.1 git-web-2.35.3-150300.10.12.1 gitk-2.35.3-150300.10.12.1 perl-Git-2.35.3-150300.10.12.1 git-core-2.35.3-150300.10.12.1 as a component of Container bci/golang:1.16 git-core-2.35.3-150300.10.12.1 as a component of Container bci/golang:1.17 git-core-2.35.3-150300.10.12.1 as a component of Container bci/golang:1.18 git-core-2.35.3-150300.10.12.1 as a component of Container bci/golang:1.19 git-core-2.35.3-150300.10.12.1 as a component of Container bci/golang:1.20-openssl git-core-2.35.3-150300.10.12.1 as a component of Container bci/golang:1.21 git-core-2.35.3-150300.10.12.1 as a component of Container bci/golang:latest git-core-2.35.3-150300.10.12.1 as a component of Container bci/node:12 git-core-2.35.3-150300.10.12.1 as a component of Container bci/node:14 git-core-2.35.3-150300.10.12.1 as a component of Container bci/node:16 git-core-2.35.3-150300.10.12.1 as a component of Container bci/node:18 git-core-2.35.3-150300.10.12.1 as a component of Container bci/nodejs:latest git-core-2.35.3-150300.10.12.1 as a component of Container bci/openjdk-devel:11 git-core-2.35.3-150300.10.12.1 as a component of Container bci/openjdk-devel:latest git-core-2.35.3-150300.10.12.1 as a component of Container bci/openjdk:11 git-core-2.35.3-150300.10.12.1 as a component of Container bci/openjdk:17 git-core-2.35.3-150300.10.12.1 as a component of Container bci/python:3 git-core-2.35.3-150300.10.12.1 as a component of Container bci/python:latest git-core-2.35.3-150300.10.12.1 as a component of Container bci/ruby:latest git-core-2.35.3-150300.10.12.1 as a component of Container suse/git:latest git-core-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 perl-Git-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 git-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-arch-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-cvs-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-daemon-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-doc-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-email-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-gui-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-svn-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-web-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 gitk-2.35.3-150300.10.12.1 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP3 git-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-arch-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-core-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-credential-gnome-keyring-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-credential-libsecret-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-cvs-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-daemon-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-doc-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-email-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-gui-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-p4-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-svn-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-web-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 gitk-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 perl-Git-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.3 git-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-arch-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-core-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-credential-gnome-keyring-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-credential-libsecret-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-cvs-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-daemon-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-doc-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-email-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-gui-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-p4-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-svn-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 git-web-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 gitk-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 perl-Git-2.35.3-150300.10.12.1 as a component of openSUSE Leap 15.4 Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`. CVE-2022-24765 Container bci/golang:1.16:git-core-2.35.3-150300.10.12.1 Container bci/golang:1.17:git-core-2.35.3-150300.10.12.1 Container bci/golang:1.18:git-core-2.35.3-150300.10.12.1 Container bci/golang:1.19:git-core-2.35.3-150300.10.12.1 Container bci/golang:1.20-openssl:git-core-2.35.3-150300.10.12.1 Container bci/golang:1.21:git-core-2.35.3-150300.10.12.1 Container bci/golang:latest:git-core-2.35.3-150300.10.12.1 Container bci/node:12:git-core-2.35.3-150300.10.12.1 Container bci/node:14:git-core-2.35.3-150300.10.12.1 Container bci/node:16:git-core-2.35.3-150300.10.12.1 Container bci/node:18:git-core-2.35.3-150300.10.12.1 Container bci/nodejs:latest:git-core-2.35.3-150300.10.12.1 Container bci/openjdk-devel:11:git-core-2.35.3-150300.10.12.1 Container bci/openjdk-devel:latest:git-core-2.35.3-150300.10.12.1 Container bci/openjdk:11:git-core-2.35.3-150300.10.12.1 Container bci/openjdk:17:git-core-2.35.3-150300.10.12.1 Container bci/python:3:git-core-2.35.3-150300.10.12.1 Container bci/python:latest:git-core-2.35.3-150300.10.12.1 Container bci/ruby:latest:git-core-2.35.3-150300.10.12.1 Container suse/git:latest:git-core-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:git-core-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:perl-Git-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-arch-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-cvs-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-daemon-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-doc-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-email-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-gui-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-svn-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:git-web-2.35.3-150300.10.12.1 SUSE Linux Enterprise Module for Development Tools 15 SP3:gitk-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-arch-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-core-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-credential-gnome-keyring-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-credential-libsecret-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-cvs-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-daemon-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-doc-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-email-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-gui-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-p4-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-svn-2.35.3-150300.10.12.1 openSUSE Leap 15.3:git-web-2.35.3-150300.10.12.1 openSUSE Leap 15.3:gitk-2.35.3-150300.10.12.1 openSUSE Leap 15.3:perl-Git-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-arch-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-core-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-credential-gnome-keyring-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-credential-libsecret-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-cvs-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-daemon-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-doc-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-email-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-gui-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-p4-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-svn-2.35.3-150300.10.12.1 openSUSE Leap 15.4:git-web-2.35.3-150300.10.12.1 openSUSE Leap 15.4:gitk-2.35.3-150300.10.12.1 openSUSE Leap 15.4:perl-Git-2.35.3-150300.10.12.1 important 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221484-1/ https://www.suse.com/security/cve/CVE-2022-24765.html CVE-2022-24765 https://bugzilla.suse.com/1198234 SUSE Bug 1198234 https://bugzilla.suse.com/1199109 SUSE Bug 1199109 https://bugzilla.suse.com/1200119 SUSE Bug 1200119 https://bugzilla.suse.com/1200201 SUSE Bug 1200201 https://bugzilla.suse.com/1201431 SUSE Bug 1201431 https://bugzilla.suse.com/1201794 SUSE Bug 1201794